Obligations
What a Data Fiduciary, which includes most apps, must do under the DPDP Act and Rules.
Notice requirements
What a DPDP notice must contain for a mobile app, from an itemised list of data and purposes to withdrawal links, language choice and the Rule 3 standard.
Consent
How consent works under India's DPDP Act for apps, covering the s.6 standard, data minimisation, withdrawal as easy as opt-in and the burden of proof.
Legitimate uses
The closed list of legitimate uses in s.7 of the DPDP Act, when an app can process personal data without consent, and why there is no legitimate interests test.
Children's data
How the DPDP Act treats users under 18, with verifiable parental consent under Rule 10, the ban on tracking and targeted ads, and Fourth Schedule exemptions.
Data principal rights
The rights app users get under the DPDP Act, from access, correction and erasure to grievance and nomination, with Rule 14 duties and the 90-day ceiling.
Grievance redressal
What the DPDP Act requires of an app's grievance process, from published contact details under Rule 9 to the 90-day response ceiling and the route to the Board.
Security safeguards
The minimum security measures in Rule 6 of the DPDP Rules for mobile apps, from encryption and access controls to one-year logs and processor contracts.
Breach notification
How an app must report a personal data breach under the DPDP Act, with notice to each affected user, a Board report without delay and details within 72 hours.
Retention and erasure
When an app must erase personal data under the DPDP Act, the three-year rule for large platforms, the 48-hour warning and the one-year log minimum in Rule 8.
Processors and SDKs
How the DPDP Act treats vendors and SDKs inside an app, from the valid contract rule and fiduciary responsibility to withdrawal, erasure and naming recipients.
Cross-border transfers
How the DPDP Act treats transfers of app user data outside India, from the negative list in s.16 to Rule 15 conditions, sector laws and the SDF data rule.
Significant data fiduciaries
What a Significant Data Fiduciary is under the DPDP Act, how designation works, and the extra duties of an Indian DPO, independent audits and yearly DPIAs.
Consent managers
What a Consent Manager is under the DPDP Act, when Rule 4 registration starts on 13 November 2026, and why users can still give consent to an app directly.
Penalties
The DPDP Act penalty schedule for apps, from ₹250 crore for weak security to ₹50 crore for other breaches, with how the Board sets amounts and hears appeals.
Personal data in attribution
What the DPDP Act may mean for analytics, attribution and marketing SDKs, advertising IDs and IP addresses, separating the law from law firm interpretation.
Marketing SDK checklist
Twelve DPDP checks for each attribution, analytics and ad SDK in your app: purpose, necessary data, processor role, contract, withdrawal, erasure and logs.
Consent for ad tracking
How DPDP consent rules apply to ad tracking and attribution, mapped screen by screen to an app's onboarding flow, from first launch to withdrawal in settings.
Children and ad tracking
What the DPDP ban on tracking and targeted ads at children means for apps with young users: what parental consent does not unlock, exemptions and age signals.